Comments (2)
My mistake, I figured CryptoKit would have a function for generating/storing non-exportable symmetric keys for use with HMAC but it seems public key elliptic P-256 is the only supported key type and it is expected that applications use that to protect other secrets which are then used outside of the enclave which indeed does not produce the same security properties.
I agree with your conclusion that doing it outside the enclave wouldn't be right because it would be misleading users into thinking that it's equivalent to a physical key security wise. I'm actually glad you take a hard stance on such issues because otherwise you end up doing silly things like end-to-end encryption using unverified JavaScript in the browser like so many other products.
Much appreciated! Have a great day
from keepassium.
The very point of a hardware key is that:
- it must be present,
- it cannot be cloned.
Any app which keeps the HMAC secret on the phone automatically fails the first criterion. The phone becomes the only device required to open a database. So if an attacker shoulder-surfs your database (and/or phone) password, the game is over. With a real hardware key, the database remains perfectly protected.
A "software hardware key" also fails the "cannot be cloned" part. The thing is, Secure Enclave (SE) does not perform HMAC-SHA1, so this would need to be done in software, by the app. Which means that at some point the app would need to have the plain-text HMAC secret in device memory. Which makes it vulnerable to copying. Yes, it would be more complicated than copying a key file, but nevertheless. In contrast, a physical hardware key never exposes the secret to the outer world, making it impossible to copy at all.
To my taste, this level of convenience-vs-security tradeoff is too far from the "security" end. I don't want to enable bad security practices, so KeePassium is not planning any kind of "software hardware keys".
Buying another key with NFC or lightning, and perhaps another one for backup and constantly having to tap your phone with a key is just not something I’d imagine a lot of people would be doing.
Information protection is a spectrum. There are millions of people who think that "letmein" is a good password for all their services. Can they imagine people like us, who don't know their passwords, keep multiple backup copies, use an app to log in to anything, sometimes even pay for that app? And they are right: "letmein" is easy, free and waaaay more convenient. Yet here we are :)
from keepassium.
Related Issues (20)
- 1.47 and 1.4.8 release sources HOT 3
- iOS, Apple Files App, OneDrive HOT 1
- macOS: AutoFill does not see WebDAV databases added by the main app HOT 3
- Quick AutoFill does not distinguish port numbers
- Support custom wordlists in passphrase generator HOT 1
- [iOS/Safari] No passwords filled in after selection HOT 7
- [App] Local Database is shown twice HOT 8
- iOS 17.3: AutoFill does not see main app's local directory HOT 1
- Nitrokey3 support HOT 1
- iOS Dropbox Sync not working HOT 6
- Build failed for the `master` branch on macOS Sonoma 14.3.1 HOT 7
- Add ability to launch keepassium from system tray icon HOT 3
- Custom hotkeys/shortcuts/macros are blocked while KeePassium is running HOT 4
- Dropbox sync issues HOT 1
- iOS: password-to-clipboard function changes uppercase letters to lowercase HOT 1
- Some storage providers are "blocked by your organization" HOT 3
- [iOS/Safari] Empty Username clears field rather than not typing anything HOT 2
- No search with autofill HOT 5
- Random Generator UX improvement suggestions. HOT 5
- Some USB YubiKeys could be processed incorrectly HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from keepassium.